{"record":{"id":"e772c5842a82cd51","repo":"RocketChat/Rocket.Chat","slug":"error-action-not-allowed-e772c5","errorCode":"error-action-not-allowed","errorMessage":"Accessing permissions is not allowed","messagePattern":"Accessing permissions is not allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/auth/addUserToRole.ts","lineNumber":12,"sourceCode":"import { api } from '@rocket.chat/core-services';\nimport type { IRole, IUser } from '@rocket.chat/core-typings';\nimport { Roles, Users } from '@rocket.chat/models';\nimport { Meteor } from 'meteor/meteor';\n\nimport { hasPermissionAsync } from '../../lib/authorization/hasPermission';\nimport { addUserRolesAsync } from '../../lib/roles/addUserRoles';\nimport { settings } from '../../settings';\n\nexport const addUserToRole = async (userId: string, roleId: string, username: IUser['username'], scope?: string): Promise<boolean> => {\n\tif (!(await hasPermissionAsync(userId, 'access-permissions'))) {\n\t\tthrow new Meteor.Error('error-action-not-allowed', 'Accessing permissions is not allowed', {\n\t\t\tmethod: 'authorization:addUserToRole',\n\t\t\taction: 'Accessing_permissions',\n\t\t});\n\t}\n\n\tif (!roleId || typeof roleId.valueOf() !== 'string' || !username || typeof username.valueOf() !== 'string') {\n\t\tthrow new Meteor.Error('error-invalid-arguments', 'Invalid arguments', {\n\t\t\tmethod: 'authorization:addUserToRole',\n\t\t});\n\t}\n\n\tconst role = await Roles.findOneById<Pick<IRole, '_id'>>(roleId, { projection: { _id: 1 } });\n\n\tif (!role) {\n\t\tthrow new Meteor.Error('error-invalid-role', 'Invalid Role', {\n\t\t\tmethod: 'authorization:addUserToRole',\n\t\t});\n\t}","sourceCodeStart":1,"sourceCodeEnd":30,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/auth/addUserToRole.ts#L1-L30","documentation":"The core addUserToRole() helper first demands the 'access-permissions' permission from its caller; lacking it throws error-action-not-allowed with action 'Accessing_permissions'. All role-assignment paths (DDP 'authorization:addUserToRole' and the REST roles.addUserToRole flow) funnel through this check, so it applies even if the caller can render the permissions screen.","triggerScenarios":"A user whose roles lack access-permissions calling Meteor.call('authorization:addUserToRole', roleId, username, scope) or the roles.addUserToRole flow; custom permission sets that removed this grant from a staff role.","commonSituations":"Delegating user management to moderator/sub-admin roles without granting access-permissions; permission-matrix customizations that accidentally dropped the grant; automation using a non-privileged token.","solutions":["Grant 'access-permissions' to the caller's role under Authorization > Permissions.","Perform the assignment as a full admin user.","Switch the automation to an admin token."],"exampleFix":"// before: caller lacks access-permissions -> error-action-not-allowed\nMeteor.call('authorization:addUserToRole', roleId, username, scope);\n\n// after: perform as admin (or grant access-permissions to the caller's role first)\nawait withAdminSession(() => Meteor.callAsync('authorization:addUserToRole', roleId, username, scope));","handlingStrategy":"try-catch","validationCode":"// Server-side pre-check mirroring the guard\nif (!(await hasPermissionAsync(userId, 'access-permissions'))) {\n  throw new Error('caller needs access-permissions');\n}\nawait addUserToRole(userId, roleId, username, scope);","typeGuard":null,"tryCatchPattern":"try {\n  await addUserToRole(userId, roleId, username, scope);\n} catch (err: any) {\n  if (err?.error === 'error-action-not-allowed' && err?.details?.action === 'Accessing_permissions') {\n    // retry with an admin session or inform the user they lack permission management rights\n    return escalateToAdmin(() => addUserToRole(adminId, roleId, username, scope));\n  }\n  throw err;\n}","preventionTips":["When delegating user management, grant access-permissions to the delegated role explicitly.","Audit custom permission sets after role/permission refactors.","Use admin tokens for provisioning scripts."],"tags":["permissions","roles","authorization"],"backgroundTag":"permission-denied","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}